REMARKS 

Claims 1,16, and 17 have been amended to clarify the subject matter regarded as the 
invention. Claims 1-9,11-13, and 1 5- 1 7 are pending. 

Claims 1-9, 1 1-13, 15-17 stand rejected under 35 U.S.C. §103(a) as being unpatentable 
over Taj alii in view of Connor and further in view of Brown. 

The rejection is respectfully traversed. With respect to claims 1,16, and 17, none of the 
references describes parsing a prefetch file to learn the permitted behavior of a process upon 
initialization, specifically the resources that the process accesses during normal operation upon 
initialization, and using that information to detect that an unauthorized behavior has occurred, 
i.e., that the process has accessed or attempted to access a resource not in its prefetch file. The 
newly cited reference, Brown, describes parsing web pages, see [0053], but that has nothing to 
do with parsing a prefetch file as recited m claims 1, 16, and 17. Because none of the references 
describes parsing a prefetch file, much less doing so to determine permitted behaviors of an 
associated process, a prima facie case of obviousness is not stated in the office action. In 
addition, the claims have been amended to recite monitoring the prefetch file to detect changes 
thereto and re-leaming the authorized behavior of the process if a change to the prefetch file is 
detected, as may occur for example after a software update. None of the references describes 
such monitoring of the prefetch file for changes, and the claims are believed to be allowable for 
this additional and independently sufficient reason. 

The remaining claims depend from claim 1 and are believed to be allowable for the same 
reasons described above. 

The foregoing amendments are not to be taken as an admission of unpatentability of any 
of the claims prior to the amendments. 
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Reconsideration of the application and allowance of all claims are respectfully requested 
based on the preceding remarks. If at any time the Examiner believes that an interview would be 
helpful, please contact the undersigned. 



Respectfully submitted, 



Dated: 

William J. James 
Registration No. 40,661 
V 408-973-2592 
F 408-973-2595 



VAN PELT, YI & JAMES LLP 
10050 N. Foothill Blvd., Suite 200 
Cupertino, CA 95014 
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